5 ms·

I work for a company who for a very long time was strongly opposed to employees using any cloud-based infrastructure, including OS or programming language packa

I work for a company who for a very long time was strongly opposed to employees using any cloud-based infrastructure, including OS or programming language package managers (eg. apt-get, Pip for Python, etc), opting to host their own instance if possible and disallowing usage if not possible. IT did finally cave and switch to Office365, which has been slowly opening the floodgates to other services being allowed.

Retric 3y ago
The gets into some really interesting corporate governance issues. The cloud is a terrible bet for many large companies. The benefits are minimal while the risks are huge, however what’s in the best interest for the company is only tangentially related to what happens. It’s really difficult to ensure companies actually take low probability risks seriously. A 1% chance to lose 10 billion dollars is an easy bet for upper management to make when their personal risks and rewards don’t line up with the company’s risks and rewards.
- jupp0r 3y ago
  As somebody who is completely puzzled why you could think that the cloud is a terrible bet for many companies - are these companies allowing their employees to use Google Search or other parts of the internet or do they have to look up things in paper books in the corporate library?
  - Retric 3y ago
    Let’s not pretend Google search is what people mean when they say “cloud.” It’s about running internal processes on external systems. As to the risks, many companies live and die by their internal secrets. These range from a private keys, customer lists, trading strategies, and similar trade secrets to actual serious R&D efforts. Sometimes the damage is obvious such as crypto exchanges suddenly finding themselves broke, but corporate espionage can also be kept quite. Losing major government bids because a competitor read some internal memo’s is a serious risk and you may never know.
    - jupp0r 3y ago
      Again, how do you know that somebody doesn't put something sensitive into the Google Search bar?
      - mixmastamyk 3y ago
        While theoretically possible for something bad to happen, short phrases are much less likely to have actionable/sensitive info in them than the full document corpus of a company.
      - Retric 3y ago
        The actual history of companies losing secrets. It’s much harder to reconstruct actionable intelligence from a huge stream of people using Google search even if they’re using it to preform sensitive calculations.
    - scarface74 3y ago
      How many companies do you think have people who know security as well as Azure, GCP or AWS (disclaimer: my employer)?
      - Retric 3y ago
        What percentage of companies do you think actually use AWS securely? There’s plenty of high profile fuckups from people falling to AWS specific gotcha’s.

Retric 3y ago

The gets into some really interesting corporate governance issues. The cloud is a terrible bet for many large companies. The benefits are minimal while the risks are huge, however what’s in the best interest for the company is only tangentially related to what happens. It’s really difficult to ensure companies actually take low probability risks seriously. A 1% chance to lose 10 billion dollars is an easy bet for upper management to make when their personal risks and rewards don’t line up with the company’s risks and rewards.

jupp0r 3y ago
As somebody who is completely puzzled why you could think that the cloud is a terrible bet for many companies - are these companies allowing their employees to use Google Search or other parts of the internet or do they have to look up things in paper books in the corporate library?
- Retric 3y ago
  Let’s not pretend Google search is what people mean when they say “cloud.” It’s about running internal processes on external systems. As to the risks, many companies live and die by their internal secrets. These range from a private keys, customer lists, trading strategies, and similar trade secrets to actual serious R&D efforts. Sometimes the damage is obvious such as crypto exchanges suddenly finding themselves broke, but corporate espionage can also be kept quite. Losing major government bids because a competitor read some internal memo’s is a serious risk and you may never know.
  - jupp0r 3y ago
    Again, how do you know that somebody doesn't put something sensitive into the Google Search bar?
    - mixmastamyk 3y ago
      While theoretically possible for something bad to happen, short phrases are much less likely to have actionable/sensitive info in them than the full document corpus of a company.
    - Retric 3y ago
      The actual history of companies losing secrets. It’s much harder to reconstruct actionable intelligence from a huge stream of people using Google search even if they’re using it to preform sensitive calculations.
  - scarface74 3y ago
    How many companies do you think have people who know security as well as Azure, GCP or AWS (disclaimer: my employer)?
    - Retric 3y ago
      What percentage of companies do you think actually use AWS securely? There’s plenty of high profile fuckups from people falling to AWS specific gotcha’s.